File: crates/client/src/worker_cache.rs:49, 61
Severity: robustness
Obvious? no
willow-client is required to build for wasm32-unknown-unknown (per CLAUDE.md dependency graph and dual-target rules). std::time::Instant compiles on WASM but its monotonic source uses Performance.now() only when configured; without wasm-bindgen's instant-flavored crate or feature gating, this is a documented trip-hazard.
There is no #[cfg(target_arch = "wasm32")] guard, and the function is not behind a feature flag — relies on whatever transitive Cargo features the consumer brings in.
Fix: gate the WorkerCache TTL eviction with #[cfg(not(target_arch = "wasm32"))], or replace Instant::now() with a portable monotonic source (web_time::Instant or HLC-derived timestamp).
Filed by /general-audit @ b901575 (2026-05-02). master: #513.
File:
crates/client/src/worker_cache.rs:49, 61Severity: robustness
Obvious? no
willow-clientis required to build forwasm32-unknown-unknown(per CLAUDE.md dependency graph and dual-target rules).std::time::Instantcompiles on WASM but its monotonic source usesPerformance.now()only when configured; withoutwasm-bindgen'sinstant-flavored crate or feature gating, this is a documented trip-hazard.There is no
#[cfg(target_arch = "wasm32")]guard, and the function is not behind a feature flag — relies on whatever transitive Cargo features the consumer brings in.Fix: gate the WorkerCache TTL eviction with
#[cfg(not(target_arch = "wasm32"))], or replaceInstant::now()with a portable monotonic source (web_time::Instantor HLC-derived timestamp).Filed by
/general-audit@b901575(2026-05-02). master: #513.